CVE-2025-20393

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 17, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-20406.3A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionCVE-2025-20419.8A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is someCVE-2025-20426.5A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The maCVE-2025-20437.2A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /adCVE-2025-20447.2A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerabilitCVE-2025-20454.3Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow userCVE-2025-20469.8A vulnerability was found in SourceCodester Best Employee Management System 1.0 and classified as critical. Affected by this issue is some uCVE-2025-20473.5A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. This affects an unknown paCVE-2025-20484.1The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an adminCVE-2025-20493.5A vulnerability classified as problematic has been found in code-projects Blood Bank System 1.0. Affected is an unknown function of the fileCVE-2025-20509.8A vulnerability classified as critical was found in PHPGurukul User Registration & Login and User Management System 3.3. Affected by this vuCVE-2025-20518.8A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. This vulnerability affects